Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

970 results · page 14 of 20

May 16, 2024A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint.CVE-2024-4322 · Other software · parisneo · reported by security@huntr.devHigh 7.5
A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary directories for listing. Successful exploitation of this vulnerability could allow an attacker to list all folders in the drive on the system, potentially leading to information disclosure.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
May 16, 2024Tutor LMS: Unauthorized access of data, modification of data, loss of dataCVE-2024-4223 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.
Product
Tutor LMS
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 16, 2024A vulnerability in the parisneo/lollms, specifically in the `/unInstall_binding` endpoint, allows for arbitrary code execution due to insufficient sanitization CVE-2024-4078 · Other software · parisneo · reported by security@huntr.devCritical 9.8
A vulnerability in the parisneo/lollms, specifically in the `/unInstall_binding` endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the `name` parameter in the `unInstall_binding` function, allowing an attacker to traverse directories and execute arbitrary code by loading a malicious `__init__.py` file. This vulnerability affects the latest version of the software. The exploitation of this vulnerability could lead to remote code execution on the system where parisneo/lollms is deployed.
Product
parisneo/lollms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
May 16, 2024A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release befoCVE-2024-3435 · Other software · parisneo · reported by security@huntr.devHigh 8.4
A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
May 16, 2024A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.pyCVE-2024-3126 · Other software · parisneo · reported by security@huntr.devHigh 8.4
A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
May 16, 2024A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/loCVE-2024-2366 · Other software · parisneo · reported by security@huntr.devCritical 9
A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in lollms_core/lollms/server/endpoints/lollms_binding_infos.py of the latest version. The vulnerability arises due to insufficient path sanitization, allowing an attacker to exploit path traversal to navigate to arbitrary directories. By manipulating the binding_path to point to a controlled directory and uploading a malicious __init__.py file, an attacker can execute arbitrary code on the server.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
May 16, 2024A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input.CVE-2024-2361 · Other software · parisneo · reported by security@huntr.devCritical 9.6
A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the application fails to properly sanitize the `file://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the `path` and `variant_name` parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
May 16, 2024A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code.CVE-2024-2358 · Other software · parisneo · reported by security@huntr.devCritical 9.8
A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious '__init__.py' file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
May 16, 2024Tutor LMS: Time-based SQL InjectionCVE-2024-4318 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tutor LMS
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2024Tutor LMS – eLearning and online course solution: Insecure Direct Object Reference to Arbitrary Course DeletionCVE-2024-4279 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024LearnPress – WordPress LMS: Bypass to user registrationCVE-2024-4444 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in the 'create_account' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record inky-knuckle-2c2.notion.site plugins.trac.wordpress.org
May 14, 2024LearnPress – WordPress LMS: Time-based SQL InjectionCVE-2024-4434 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record inky-knuckle-2c2.notion.site plugins.trac.wordpress.org
May 14, 2024LearnPress – WordPress LMS: Arbitrary file uploadsCVE-2024-4397 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-4277 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.5
What to do
Affects up to 4.2.6.5. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2024Academy LMS: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35171 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a through 1.9.25.
Product
Academy LMS
Affected
up to 1.9.25
What to do
Affects up to 1.9.25. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers toCVE-2024-34225 · Other software · computer_laboratory_management_system · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the name, shortname parameters.
Product
compuer_labatory_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 14, 2024Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers CVE-2024-34224 · Other software · sourcecodester · reported by MITREHigh 7.3
Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the firstname, middlename, lastname parameters.
Product
computer_laboratory_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 14, 2024A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile piCVE-2024-2299 · Other software · parisneo · reported by security@huntr.devMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is executed when the file is accessed. This vulnerability is remotely exploitable via Cross-Site Request Forgery (CSRF), allowing attackers to perform actions on behalf of authenticated users and potentially leading to unauthorized access to sensitive information within the Lollms-webui application.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
May 6, 2024Academy LMS: Missing AuthorizationCVE-2024-33912 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16.
Product
Academy LMS
Affected
up to 1.9.16
What to do
Affects up to 1.9.16. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized access, modification, and loss of dataCVE-2024-3942 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2024-3553 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 25, 2024Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2024-3994 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-3560 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.4
What to do
Affects up to 4.2.6.4. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2024A vulnerability classified as problematic has been found in Totara LMS up to 18.7.CVE-2024-3932 · Other software · Totara · reported by VulDBLow 1.3
A vulnerability classified as problematic has been found in Totara LMS up to 18.7. This affects an unknown part of the component User Selector. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component.
Product
LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record totara.community vuldb.com
Apr 17, 2024A vulnerability was found in Totara LMS up to 18.7.CVE-2024-3931 · Other software · Totara · reported by VulDBLow 2
A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/roles/check.php of the component User Selector. The manipulation of the argument ID Number leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component.
Product
LMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record totara.community vuldb.com
Apr 16, 2024Open WebUI is a user-friendly WebUI for LLMs.CVE-2024-30256 · Other software · open-webui · reported by GitHubMedium 6.4
Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117.
Product
open-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com securitylab.github.com
Apr 15, 2024parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints.CVE-2024-1646 · Other software · parisneo · reported by security@huntr.devHigh 8.2
parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as '/restart_program', '/update_software', '/check_update', '/start_recording', and '/stop_recording'. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Apr 15, 2024An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussCVE-2024-1601 · Other software · parisneo · reported by security@huntr.devCritical 9.8
An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the `/delete_discussion` endpoint, which internally calls the vulnerable `delete_discussion()` function. By sending a specially crafted payload in the 'id' parameter, an attacker can manipulate SQL queries to delete all records from the 'discussion' and 'message' tables. This issue is due to improper neutralization of special elements used in an SQL command.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Apr 15, 2024parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption.CVE-2024-1569 · Other software · parisneo · reported by security@huntr.devHigh 7.5
parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Apr 12, 2024LifterLMS: Cross-Site Request Forgery (CSRF)CVE-2024-31363 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in LifterLMS.This issue affects LifterLMS: from n/a through 7.5.0.
Product
LifterLMS
Affected
up to 7.5.0
What to do
Affects up to 7.5.0. Update LifterLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE).CVE-2024-1602 · Other software · parisneo · reported by security@huntr.devMedium 6.1
parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within the user's browser context, enabling the attacker to send a request to the `/execute_code` endpoint and establish a reverse shell to the attacker's host. The issue affects various components of the application, including the handling of user input and model output.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
Apr 10, 2024A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route.CVE-2024-1600 · Other software · parisneo · reported by security@huntr.devCritical 9.3
A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Apr 10, 2024An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-suCVE-2024-1520 · Other software · parisneo · reported by security@huntr.devCritical 9.8
An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Apr 10, 2024The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths.CVE-2024-1511 · Other software · parisneo · reported by security@huntr.devCritical 9.8
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
Apr 9, 2024MasterStudy LMS: Local File InclusionCVE-2024-3136 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
MasterStudy LMS
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2024MasterStudy LMS: Unauthorized access of dataCVE-2024-1904 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.
Product
MasterStudy LMS
Affected
up to 3.2.13
What to do
Affects up to 3.2.13. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-1463 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including, 4.2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with LP Instructor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.3
What to do
Affects up to 4.2.6.3. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2024LearnPress – WordPress LMS: Insecure Direct Object ReferenceCVE-2024-1289 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it possible for authenticated attackers to obtain information on orders placed by other users and guests, which can be leveraged to sign up for paid courses that were purchased by guests. Emails of other users are also exposed.
Product
LearnPress – WordPress LMS
Affected
up to 4.2.6.3
What to do
Affects up to 4.2.6.3. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 5, 2024LearnPress – WordPress LMS: Cross-Site Request ForgeryCVE-2024-2115 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation on the filter_users functions. This makes it possible for unauthenticated attackers to elevate their privileges to that of a teacher via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
LearnPress – WordPress LMS
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 30, 2024A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system.CVE-2024-1522 · Other software · parisneo · reported by security@huntr.devHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requests, enabling an attacker to craft a malicious webpage that, when visited by a victim, submits a form to the victim's local lollms-webui instance to execute arbitrary OS commands. This issue allows attackers to take full control of the victim's system without requiring direct network access to the vulnerable application.
Product
parisneo/lollms-webui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Mar 29, 2024MasterStudy LMS: Local File InclusionCVE-2024-2411 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
MasterStudy LMS
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com plugins.trac.wordpress.org
Mar 29, 2024MasterStudy LMS: Privilege EscalationCVE-2024-2409 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.
Product
MasterStudy LMS
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com plugins.trac.wordpress.org
Mar 27, 2024Tutor LMS Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.3.
Product
Tutor LMS Elementor Addons
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Tutor LMS – eLearning and online course solution: Cross-Site Request ForgeryCVE-2024-1503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2024Tutor LMS – eLearning and online course solution: Unauthorized loss of dataCVE-2024-1502 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Information ExposureCVE-2024-2106 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.2.10
What to do
Affects up to 3.2.10. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Mar 13, 2024Tutor LMS – eLearning and online course solution: Time-based SQL InjectionCVE-2024-1751 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Academy LMS – eLearning and online course solution for: Privilege escalationCVE-2024-1505 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator.
Product
Academy LMS – eLearning and online course solution for
Affected
up to 1.9.19
What to do
Affects up to 1.9.19. Update Academy LMS – eLearning and online course solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024LifterLMS – WordPress LMS Plugin for eLearning: Unauthorized modification of dataCVE-2024-0377 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all versions up to, and including, 7.5.1. This makes it possible for unauthenticated attackers to publish an unrestricted number of reviews on the site.
Product
LifterLMS – WordPress LMS Plugin for eLearning
Affected
up to 7.5.1
What to do
Affects up to 7.5.1. Update LifterLMS – WordPress LMS Plugin for eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Tutor LMS – eLearning and online course solution: Unauthorized access of restricted Q&A contentCVE-2024-1133 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.